Commit Graph

717 Commits

Author SHA1 Message Date
Simon Charette 0bd57a879a [3.1.x] Fixed CVE-2021-35042 -- Prevented SQL injection in QuerySet.order_by().
Regression introduced in 513948735b
by marking the raw SQL column reference feature for deprecation in
Django 4.0 while lifting the column format validation.

In retrospective the validation should have been kept around and the
user should have been pointed at using RawSQL expressions during the
deprecation period.

The main branch is not affected because the raw SQL column reference
support has been removed in 06eec31970
per the 4.0 deprecation life cycle.

Thanks Joel Saunders for the report.
2021-07-01 08:36:17 +02:00
Christian Klus ab951d242e [3.1.x] Fixed #32152 -- Fixed grouping by subquery aliases.
Regression in 42c08ee465.

Thanks Simon Charette for the review.

Backport of 4ac2d4fa42 from master
2020-10-29 11:30:53 +01:00
Mariusz Felisiak 1afc9b31bb [3.1.x] Fixed #32007 -- Fixed queryset crash with Q() annotation and aggregation.
Thanks Gordon Wrigley for the report.

Regression in 8a6df55f2d.
Backport of eaf9764d3b from master
2020-09-15 11:41:42 +02:00
Simon Charette 2986ec031d [3.1.x] Fixed #31965 -- Adjusted multi-table fast-deletion on MySQL/MariaDB.
The optimization introduced in 7acef095d7 did not properly handle
deletion involving filters against aggregate annotations.

It initially was surfaced by a MariaDB test failure but misattributed
to an undocumented change in behavior that resulted in the systemic
generation of poorly performing database queries in 5b83bae031.

Thanks Anton Plotkin for the report.

Refs #23576.

Backport of f6405c0b8e from master
2020-08-31 09:22:59 +02:00
Daniel Hillier f139372491 [3.1.x] Fixed #31866 -- Fixed locking proxy models in QuerySet.select_for_update(of=()).
Backport of 60626162f7 from master
2020-08-11 12:30:31 +02:00
Hasan Ramezani 4385ef0119 [3.1.x] Fixed #31657 -- Fixed ordering by attnames of self-referential ForeignKeys.
Backport of 037a624120 from master
2020-06-10 12:05:31 +02:00
Nicolas Baccelli 83749dca7a [3.1.x] Fixed #31664 -- Reallowed using non-expressions having filterable attribute as rhs in queryset filters.
Regression in 4edad1ddf6.

Backport of b38d44229f from master
2020-06-08 09:18:32 +02:00
Laurent Tramoy df88f24b1f [3.1.x] Fixed #31614 -- Fixed aliases ordering by OrderBy() expressions of combined queryset.
Backport of 2aac176e86 from master
2020-05-26 23:35:34 +02:00
Simon Charette d91095def4 [3.1.x] Fixed #31624 -- Avoided subquery usage on QuerySet.all().delete().
Thanks Adam Johnson for the report.

Regression in 7acef095d7.

Backport of 972000420e from master
2020-05-25 08:47:51 +02:00
Mariusz Felisiak b46b0f80e8 [3.1.x] Fixed #31584 -- Fixed crash when chaining values()/values_list() after Exists() annotation and aggregation on Oracle.
Oracle requires the EXISTS expression to be wrapped in a CASE WHEN in
the GROUP BY clause.

Regression in efa1908f66.
Backport of 3a941230c8 from master
2020-05-14 15:10:28 +02:00
Simon Charette 3913acdb29 [3.1.x] Fixed #31568 -- Fixed alias reference when aggregating over multiple subqueries.
691def10a0 made all Subquery() instances
equal to each other which broke aggregation subquery pushdown which
relied on object equality to determine which alias it should select.

Subquery.__eq__() will be fixed in an another commit but
Query.rewrite_cols() should haved used object identity from the start.

Refs #30727, #30188.

Thanks Makina Corpus for the report.

Backport of adfbf653dc from master
2020-05-14 10:26:05 +02:00
Simon Charette 8cb87a3f7c [3.1.x] Fixed #31566 -- Fixed aliases crash when chaining values()/values_list() after annotate() with aggregations and subqueries.
Subquery annotation references must be resolved if they are excluded
from the GROUP BY clause by a following .values() call.

Regression in fb3f034f1c.

Thanks Makina Corpus for the report.

Backport of 42c08ee465 from master
2020-05-14 08:39:21 +02:00
Jon Dufresne d6aff369ad Refs #30116 -- Simplified regex match group access with Match.__getitem__().
The method has been available since Python 3.6. The shorter syntax is
also marginally faster.
2020-05-11 12:01:28 +02:00
Adam Johnson 67f9d076cf
Avoided unnecessary recompilation of ordering clause regex in SQLCompiler. 2020-04-22 20:28:01 +02:00
Simon Charette 513948735b Fixed #31426 -- Added proper field validation to QuerySet.order_by().
Resolve the field reference instead of using fragile regex based string
reference validation.
2020-04-06 10:19:49 +02:00
Simon Charette 98ea4f0f46 Refs #7098 -- Deprecated passing raw column aliases to order_by().
Now that order_by() has expression support passing RawSQL() can achieve
the same result.

This was also already supported through QuerySet.extra(order_by) for
years but this API is more or less deprecated at this point.
2020-04-06 10:01:02 +02:00
Hasan Ramezani 4237050684 Fixed #31420 -- Fixed crash when filtering subquery annotation against a SimpleLazyObject.
Thanks Simon Charette for the solution and analysis.
2020-04-06 07:11:29 +02:00
Adam Johnson c06d7c9239 Refs #31403 -- Made SQLInsertCompiler.execute_sql() always return an iterable of rows.
List of tuples.
2020-03-31 07:12:11 +02:00
Hasan Ramezani 10866a10fe Fixed #31377 -- Disabled grouping by aliases on QuerySet.values()/values_list() when they collide with field names.
Regression in fb3f034f1c.

Thanks Holovashchenko Vadym for the report.
2020-03-25 09:13:46 +01:00
Jon Dufresne 013147fae2 Fixed #31285 -- Fixed inherited Meta.ordering of "-pk". 2020-03-19 12:57:07 +01:00
Abhijeet Viswa 1712a76b9d Fixed #31246 -- Fixed locking models in QuerySet.select_for_update(of=()) for related fields and parent link fields with multi-table inheritance.
Partly regression in 0107e3d105.
2020-02-11 20:43:57 +01:00
Jon Dufresne 3259983f56 Fixed #31233 -- Closed database connections and cursors after use. 2020-02-06 15:35:23 +01:00
Nick Pope 335c9c94ac Simplified imports from django.db and django.contrib.gis.db. 2020-02-04 13:20:06 +01:00
Mariusz Felisiak 6b178a3e93
Fixed #31217 -- Made QuerySet.values()/values_list() group by not selected annotations with aggregations used in order_by().
Regression in 59b4e99dd0.

Thanks Jon Dufresne for the report and Simon Charette for the review.
2020-02-03 07:48:11 +01:00
Mariusz Felisiak 59b4e99dd0
Refs #31136 -- Made QuerySet.values()/values_list() group only by selected annotation.
Regression in 0f843fdd5b.
2020-01-15 09:32:42 +01:00
Mariusz Felisiak 0f843fdd5b
Fixed #31136 -- Disabled grouping by aliases on QuerySet.values()/values_list().
Regression in fb3f034f1c.

Thanks Sigurd Ljødal for the report.
2020-01-04 20:49:11 +01:00
Simon Charette 720de4d044 Fixed #31109 -- Disabled grouping by aliases on QuerySet.exists().
Clearing the SELECT clause in Query.has_results was orphaning GROUP BY
references to it.

Thanks Thierry Bastian for the report and Baptiste Mispelon for the
bisect.

Regression in fb3f034f1c.
2019-12-23 09:24:03 +01:00
Simon Charette 5a4d7285bd Fixed #31094 -- Included columns referenced by subqueries in GROUP BY on aggregations.
Thanks Johannes Hoppe for the report.

Regression in fb3f034f1c.

Co-authored-by: Mariusz Felisiak <felisiak.mariusz@gmail.com>
2019-12-19 10:04:56 +01:00
Baptiste Mispelon 09341856ed Used Signature API instead of deprecated inspect.getcallargs().
inspect.getcallargs() was deprecated in Python 3.5 and the Signature
API (PEP 362) has better support for decorated functions (by default,
it follows the __wrapped__ attribute set by functools.wraps for
example).
2019-12-10 09:36:34 +01:00
Alex Aktsipetrov 723fc7fcf6 Made Query.check_filterable() use bool by default instead of str. 2019-12-06 13:52:36 +01:00
Alex Aktsipetrov bf12273db4 Fixed #31060 -- Reallowed window expressions to be used in conditions outside of queryset filters.
Regression in 4edad1ddf6.

Thanks utapyngo for the report.
2019-12-06 13:52:16 +01:00
Mariusz Felisiak 0107e3d105
Fixed #30953 -- Made select_for_update() lock queryset's model when using "self" with multi-table inheritance.
Thanks Abhijeet Viswa for the report and initial patch.
2019-12-02 07:57:19 +01:00
Simon Charette f97a6123c0 Refs #25367 -- Made Query.build_filter() raise TypeError on non-conditional expressions. 2019-11-21 11:56:35 +01:00
Simon Charette e9a0e1d4f6 Fixed #30484 -- Added conditional expressions support to CheckConstraint. 2019-11-21 11:56:35 +01:00
Simon Charette 37e6c5b79b Refs #25367 -- Moved conditional expression wrapping to the Exact lookup. 2019-11-21 11:56:35 +01:00
Simon Charette 306b687520 Refs #11964 -- Removed SimpleCol in favor of Query(alias_cols).
This prevent having to pass simple_col through multiple function calls
by defining whether or not references should be resolved with aliases
at the Query level.
2019-11-21 11:56:35 +01:00
Simon Charette 3ca77e2b84 Replaced QueryWrapper single usage with RawSQL. 2019-11-18 10:45:24 +01:00
George Marshall 8be79984dc Fixed #30971 -- Prevented Query.resolve_lookup_value() from coercing list values to tuples.
Regression in 8a281aa7fe.
2019-11-13 08:27:26 +01:00
Hasan Ramezani e3d0b4d550 Fixed #30899 -- Lazily compiled import time regular expressions. 2019-10-29 09:22:26 +01:00
Simon Charette 7acef095d7 Fixed #23576 -- Implemented multi-alias fast-path deletion in MySQL backend.
This required moving the entirety of DELETE SQL generation to the
compiler where it should have been in the first place and implementing
a specialized compiler on MySQL/MariaDB.

The MySQL compiler relies on the "DELETE table FROM table JOIN" syntax
for queries spanning over multiple tables.
2019-10-24 12:24:53 +02:00
Hasan Ramezani 6a75cea76a Fixed #30854 -- Fixed QuerySet.select_related() with multiple FilteredRelations. 2019-10-11 08:10:48 +02:00
Hasan Ramezani e1ae2b0050 Refs #30854 -- Moved local_setter() outside the loop in SQLCompiler.get_related_selections(). 2019-10-11 08:07:07 +02:00
Mads Jensen 129583a0d3 Removed some outdated backwards compatibility imports and misleading comments.
EmptyResultSet moved in 46509cf13d.
FieldDoesNotExist moved in 8958170755.
BoundField and pretty_name moved in 8550161e53.
EMPTY_VALUES moved in 471596fc1a.
BaseRunserverCommand moved in 5c53e30607.
2019-09-24 15:18:53 +02:00
Mariusz Felisiak 01104368ff Refs #29444 -- Removed redundant DatabaseFeatures.can_return_multiple_columns_from_insert.
Unnecessary since b31e63879e.
2019-09-24 10:37:22 +02:00
Johannes Hoppe b31e63879e Fixed #29444 -- Allowed returning multiple fields from INSERT statements on Oracle. 2019-09-24 10:22:43 +02:00
Simon Charette 37f8f29377 Fixed #30796 -- Prevented select_related() from mutating a queryset on chaining.
Thanks Darren Maki for the report.
2019-09-24 09:17:45 +02:00
Mariusz Felisiak 0ddb4ebf7b Refs #14357 -- Made Meta.ordering not affect GROUP BY queries.
Per deprecation timeline.
2019-09-10 12:01:00 +02:00
Vojtech Bocek b1d37fea8f Fixed #28107 -- Added DatabaseFeatures.allows_group_by_selected_pks_on_model() to allow enabling optimization for unmanaged models. 2019-09-09 14:04:46 +02:00
Johannes Hoppe 7254f1138d Refs #29444 -- Allowed returning multiple fields from INSERT statements on PostgreSQL.
Thanks Florian Apolloner, Tim Graham, Simon Charette, Nick Pope, and
Mariusz Felisiak for reviews.
2019-09-09 10:51:14 +02:00
Simon Charette 13a8884a08 Fixed #30739 -- Fixed exclusion of multi-valued lookup against outer rhs.
OuterRef right hand sides have to be nested, just like F rhs have to,
during the subquery pushdown split_exclude performs to ensure they are
resolved against the outer query aliases.
2019-09-02 10:52:36 +02:00